nanog mailing list archives
Re: Death of the Internet, Film at 11
From: Valdis.Kletnieks () vt edu
Date: Wed, 26 Oct 2016 01:30:02 -0400
On Tue, 25 Oct 2016 18:54:22 -0500, Larry Sheldon said:
What is it? 20 years? since the first time I was banned from NANOG for saying that the world would be a nicer place if EVERY true router refused to forward a packet whose SOURCE could not be reached from the port question. (May not be stated clearly, but idea seems simple enough: If the proposed ICMP message would not be routed to the port the packet came from, the best plan is probably to log the event and drop the ICMP and the rogue packet on the floor.)
That's not going to work when there's asymmetric routing. Say you get an inbound packet from eth0 and the routing table says you should send it out on eth2. However, it has DF set and eth2 has a smaller MTU, so you need to send back an ICMP FRAG reply. Now, do you send it out, or do you create a PMTUD black hole by dropping the reply because your local table says the source is routed out eth1? Hint: there's a difference between strict uRPF and loose uRPF.
Attachment:
_bin
Description:
Current thread:
- Re: Spitballing IoT Security, (continued)
- Re: Spitballing IoT Security Ronald F. Guilmette (Oct 26)
- Re: Spitballing IoT Security Mark Andrews (Oct 26)
- Re: Death of the Internet, Film at 11 bzs (Oct 24)
- Re: Death of the Internet, Film at 11 Mike Hale (Oct 24)
- Re: Death of the Internet, Film at 11 bzs (Oct 25)
- Re: Death of the Internet, Film at 11 John Weekes (Oct 24)
- Re: Death of the Internet, Film at 11 bzs (Oct 25)
- Re: Death of the Internet, Film at 11 Chris Boyd (Oct 25)
- Re: Death of the Internet, Film at 11 Larry Sheldon (Oct 25)
- Re: Death of the Internet, Film at 11 Valdis . Kletnieks (Oct 25)
- Re: Death of the Internet, Film at 11 Mike Hammett (Oct 22)
- Re: Death of the Internet, Film at 11 Rich Kulawiec (Oct 22)
- Re: Death of the Internet, Film at 11 Mike Hammett (Oct 22)
- Re: Death of the Internet, Film at 11 Mike Hammett (Oct 22)
- Re: Death of the Internet, Film at 11 David Conrad (Oct 22)
- Re: Death of the Internet, Film at 11 Florian Weimer (Oct 23)